#!/usr/bin/env bash
set -euo pipefail

# runit's run script for smallwebwaf, run again whenever smallwebwaf
# exits; the wait spaces out the restarts. SMALLWEBWAF_COMMAND names the
# command to run: rproxy when it is unset or empty, or servewaf. With any
# other value the script starts nothing and stops with a message naming it.
# exec, so that the signal `sv stop` sends reaches smallwebwaf itself.
main() {
    sleep 1
    local command="${SMALLWEBWAF_COMMAND:-rproxy}"
    case "$command" in
        rproxy) ;;
        servewaf) give_state_dir_to_smallwebwaf ;;
        *)
            printf 'SMALLWEBWAF_COMMAND: "%s" is not rproxy or servewaf\n' \
                "$command" >&2
            exit 1
            ;;
    esac
    exec chpst -u smallwebwaf:smallwebwaf /usr/local/bin/smallwebwaf "$command"
}

# give_state_dir_to_smallwebwaf gives the state directory and every file in
# it to the smallwebwaf user, so that a volume mounted there needs no change
# of owner; chown -R changes a symbolic link itself, never what it points
# to. When SWWAF_STATE_DIR, in either form, cannot be read or is not the
# absolute path of a directory, no owner is changed, and servewaf starts and
# stops with a message naming the setting. A change of owner that fails, as
# on a volume mounted read-only, does not end the script either: servewaf
# reports a directory it cannot write.
give_state_dir_to_smallwebwaf() {
    local dir
    if dir="$(state_dir)" && [[ "$dir" == /* && -d "$dir" ]]; then
        chown -R smallwebwaf:smallwebwaf "$dir" || true
    fi
}

# state_dir prints SWWAF_STATE_DIR, /var/lib/smallwebwaf when it is unset,
# or what is in the file SWWAF_STATE_DIR_FILE names, less every newline at
# its end. It fails when both are set or the file cannot be read.
state_dir() {
    if [[ ! -v SWWAF_STATE_DIR_FILE ]]; then
        printf '%s\n' "${SWWAF_STATE_DIR-/var/lib/smallwebwaf}"
    elif [[ ! -v SWWAF_STATE_DIR ]]; then
        cat -- "$SWWAF_STATE_DIR_FILE" 2>/dev/null
    else
        return 1
    fi
}

main "$@"